/* Copyright (C) 2007-2026 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free * Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * version 2 along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA * 02110-1301, USA. */ /** * \file * Lightweight indirection layer for capture-related callbacks. * * This module lets the capture implementation register small hooks that the * generic engine can invoke without hard dependencies. Two hooks are used: * - on-alerts: invoked when a packet produced alerts so capture can update * per-input stats (e.g., deciding if a pcap should be deleted or kept). * - on-pseudo-created: invoked when the engine creates pseudo packets (e.g., * flow timeout or shutdown flush). This allows capture to retain references * or track alert outcomes tied to those pseudo packets. */ #include "suricata-common.h" #include "capture-hooks.h" static CaptureOnPacketWithAlertsHook g_on_alerts_hook = NULL; static CaptureOnPseudoPacketCreatedHook g_on_pseudo_created_hook = NULL; void CaptureHooksSet( CaptureOnPacketWithAlertsHook OnAlerts, CaptureOnPseudoPacketCreatedHook OnPseudoCreated) { /* Allow re-setting the same hooks (e.g. during pcap file reload), but BUG_ON * if overwriting with different ones without clearing. */ if (g_on_alerts_hook != NULL) { BUG_ON(g_on_alerts_hook != OnAlerts); } if (g_on_pseudo_created_hook != NULL) { BUG_ON(g_on_pseudo_created_hook != OnPseudoCreated); } g_on_alerts_hook = OnAlerts; g_on_pseudo_created_hook = OnPseudoCreated; } void CaptureHooksOnPacketWithAlerts(const Packet *p) { if (g_on_alerts_hook != NULL) { g_on_alerts_hook(p); } } void CaptureHooksOnPseudoPacketCreated(Packet *p) { if (g_on_pseudo_created_hook != NULL) { g_on_pseudo_created_hook(p); } }